This article was compiled and organized by BlockWeeks
Anthropic this week released the open-source prototype FlashProve, which uses zkSNARKs (the same category of zero-knowledge proof technology as Zcash) to prove that a given response was indeed generated by a specific model. It is still very early and slow, but this is the clearest signal to date: frontier AI labs have come to regard cryptography as part of their own technology stack, rather than its victim.
Starting from "Wolfie" in Terminator 2
In Terminator 2, the young John Connor befriends the T-800 played by Schwarzenegger. He calls his foster parents to warn them that a more advanced killer model, the T-1000, is on its way. On the other end of the line, a voice that sounds exactly like his foster mother answers. John senses something is wrong: the voice is warm, patient, and sweet, and his foster mother is never like that. What he doesn't know is that the Terminator, having touched someone, can imitate them perfectly. Schwarzenegger takes the phone and asks in the boy's voice what's wrong with Wolfie, because he heard the dog barking. "Wolfie's fine, honey, Wolfie's just fine."—but the dog's name is Max. The Terminator hangs up: "Your foster parents are dead."
Anthropic's release post deals with exactly the same problem, except without the liquid-metal T-1000. When you send a prompt through a router like OpenRouter or a cloud reseller, you have no truly reliable way of knowing which model is actually answering. The provider might quietly serve a cheaper, more heavily quantized version, or a compromised server might swap in something worse—in Anthropic's words, judging by output alone "is unreliable even when it produces high-quality responses." So you are just like John on the phone: you hear a voice that sounds completely right, but you have no way to verify who is really behind it.
How FlashProve works
With FlashProve, the provider first publishes a "commitment" to its weights—a cryptographic fingerprint that locks in one exact set of weights without revealing them. After that, for any request it can generate a proof: that this committed set of weights, run on that prompt, produces exactly these output tokens. Think of it as a "Wolfie question" that the T-1000 cannot bluff its way through: anyone verifying the proof learns only that the proposition is true, and nothing about the weights themselves; and forging a proof is computationally infeasible, so even a compromised host cannot fake it.
Anthropic tested it on Llama 4 Maverick—a 400B-parameter mixture-of-experts (MoE) model, though the test used a 4-bit quantized copy running in integer arithmetic, rather than the version a provider would actually serve. On a single H100, proving a batch of 24 requests takes nearly 4 minutes, with computational overhead about 70–95 times that of simply serving; and verifying each proof on a CPU takes about 17 seconds. In addition, each proof covers only a 1024-token window, shorter than this newsletter.
Anthropic's Frontier Safety Roadmap had promised to deliver a provable inference prototype by September 30; what it delivered on schedule was a more conventional system—signing inference traffic and recomputing it on trusted servers. Anthropic has since renamed this goal "inference verification," covering both kinds of work. The signing system is usable today, but ultimately you still have to trust the operator of that server, and FlashProve is precisely an attempt to eliminate this trust bottleneck.
Will AI break encryption?
Recently I have received a large number of client inquiries asking whether AI will break encryption. Will AI crack ECDSA? More than the curve itself, I worry about attackers who compromise the "plumbing" of banks—France's Crédit Mutuel Arkéa just lost an estimated $110 million or more due to a compromised vendor. Will AI bring quantum computing into reality ahead of schedule? Perhaps at the algorithmic level, but qubit limitations still make a threatening quantum computer out of the question, and industry progress is expected to beat the NSA's post-2030 quantum deadline. Meanwhile, here is precisely a frontier lab using cryptography to fix its own trust problems, and the proof system it uses happens to be post-quantum secure.
Poisoned open-source models
OpenRouter's usage continues to climb, and recent security research shows that the open-source models it serves can be easily altered to carry trigger words. In an October proof of concept, ProjectDiscovery spent about $8 of GPU time to teach Qwen2.5-7B to behave normally until it saw the words "bonsoir, Elliot." When run in OpenAI's Codex CLI, the poisoned model would download a script that steals the credentials of whoever is running the model and sends them to a third-party server. In the researchers' security evaluation, the model showed no malicious or misaligned signs before the trigger word was entered. The many "abliterated" models on Hugging Face could all keep saying "Wolfie's fine" until they hear the trigger word, and then wreak havoc. Being able to prove that you are talking to an unmodified GLM 5.3 rather than some tampered copy is like the check Schwarzenegger's Terminator did on the phone. It cannot tell you whether the original weights are clean, but unless the call is coming from inside the frontier lab, that is another story.
Once costs fall, verified inference will become a must-have for enterprises
For now, the 70–95x overhead makes FlashProve more of a toy. But the cost for a given level of capability is falling at about ten times per year. If this trend continues, routing verified inference to the lowest bidder will become something enterprises can demand; and as frontier capabilities spread, ZK proofs will eventually become a core layer of the open inference stack. The same idea applies to video. Every election cycle now brings a new batch of deepfake videos, and as AI imagery becomes harder and harder to distinguish from real footage, I expect we will want cameras that can prove "shot by this device, on this date" without revealing the identity of the person holding it.
So, no, AI will not break all cryptography. AI will build new systems while breaking legacy ones, and cryptography will prove that it was all done as advertised. To date, the cases where cryptography has been "broken" have been problems at the implementation level rather than the mathematical level: Coldcard was an implementation failure, Binance was an operational security failure. The core principles still hold, and even these "tin can" robots eventually made use of them.
Nor is Anthropic asking anyone to take all this on its word alone. The code, Lean proofs, and documentation are all open-sourced under the Apache 2.0 license. Don't trust, verify. And always remember to ask about Wolfie.
